The problem: You have just finished setting up a brand new system at your organization: top of the line, incredibly powerful, and trusted to keep sensitive information – but because of what it can do, it is vulnerable and a high profile target. This system must be protected at all cost, so your team decides to do the only sensible thing- they keep it off of the primary network, and specifically off of the Internet.
An “Air Gap” is a physical and network connection break between systems. There is no path from one system to another- wired or wireless- so that they cannot communicate with each other. In extremely sensitive systems where information cannot be allowed to move from one network to another, this security measure is employed extensively and with multiple techniques in order to keep everything safe from everything else.
Recently however, there have been methods shown to be capable of ‘jumping’ the air gap through both conventional and unconventional means.
The Solution: To deploy and defend an effective Air Gap, multiple enhancements need to be activated in addition to just having them not on the same network.
Solution the First: Disable USB ports entirely
USB devices are both extremely useful and highly dangerous. In an environment with sensitive information, it is vital to keep USB Drives, Thumb Sticks, Removable Memory Cards, whatever you call them from being allowed in the location. On top of this though, in an area where servers exist- where an air gap comes into play- it is important to keep USB ports disabled not only in the Operating System, but also outside of it. Preventing booting from USB for instance is absolutely critical in an area where you prohibit unauthorized Operating Systems.
Solution the Second: Keep a (relatively large) physical distance between the systems
Security researchers over the years have shown that it is possible to interpret the electrical signals emitted from devices as keystrokes or other kinds of data. While this is obvious in the case of something such as a Bluetooth keyboard, this can also be performed on more traditional devices as well. However, the more distance you place between the source of these emissions and what is trying to pick up on them- the exponentially more difficult it becomes. Therefore keeping more than a reasonable distance between devices on separate networks is also critical.
Solution the Third: Disable Extraneous Hardware
The past couple of years have not been kind to air gaps. More attacks have been successfully performed across an air gap using very unusual methods and in some cases very old methods that have been made new again.
For example- during the 1990s, in the early days of the Web, telephone modems were extremely common. A telephone modem is a basic device to translate data to sounds, transmit those sounds across a phone line, then translate them back on the other end. If you were to ask any number of IT people today, you would still find people saying that the sound of a modem connecting is comforting- since it gives an easy method of telling if the connection is working or not.
Fast forward to today, and you would be hard pressed to find a system in a modern organization that even has a modem in use (with the exception of faxes of course). Something that has become much more common though is built-in speakers and microphones on even server grade systems. Therefore, if you have the correct software set up on both sides of an Air Gap, it is possible not only to transmit data at a frequency that humans cannot hear, but also to re-infect systems if the vulnerability that allowed the infection in the first place has not been fixed. With this in mind, keep extra devices that are not needed at the time- cameras, microphones, speakers, Bluetooth connections, etc- disabled, turned off and removed if possible.
Honorable Mention: Lockable Server Racks
Air Gaps are an advanced defense method- to be used when alternatives are either prohibitively expensive, or not as effective. While full Air Gaps are not something that most people will ever run into, it is still an effective defense that can be used in a variety of situations.
